Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-39917

MariaDB crash triggered by JSON_TYPE and large MULTIPOLYGON string construction

    XMLWordPrintable

Details

    • Bug
    • Status: Needs Feedback (View Workflow)
    • Major
    • Resolution: Unresolved
    • 12.3.2
    • None
    • Server
    • None

    Description

      ~~~sql
      SELECT x , char_length ( x ) FROM x WHERE x = 't1' ORDER BY x ; SELECT x , x , char_length ( x ) FROM ( SELECT * FROM ( SELECT json_type ( 'true' ) AS x UNION SELECT '2018-11-02 12:34:56.78' UNION SELECT CONCAT ( 'MULTIPOLYGON(((' , REPEAT ( '-0.00000000001234567890123456789012 -0.123456789012345678,' , 1000 ) , '-0.00000000001234567890123456789012 -0.123456789012345678' , 7200 ) UNION SELECT '2018-11-02 12:34:56.78901234' ) AS x ) AS x WHERE x = 't1' ORDER BY x , x ;
      ~~~

        1. Expected result
          The server should either execute the query or return a normal SQL error without crashing.
        1. Actual result
          The fuzzing run observed a server crash. The deduplicated stack signature is:
          ~~~
          stack:pthread_kill|raise|abort|timer_settime|__default_morecore|malloc|my_malloc|heap_open_from_share
          ~~~

      Top frames:
      ~~~
      pthread_kill
      raise
      abort
      timer_settime
      __default_morecore
      malloc
      my_malloc
      heap_open_from_share
      ~~~

      Attachments

        Activity

          People

            Unassigned Unassigned
            maohaogang maohaogang
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.